Platform Security – PaaS & Hosting – Trey Ford – ESW #221

What security features does Heroku offer that the customer can control and how have these evolved over time? How do you balance the security of the application, with the security of the deployment, with the security of the platform? What are some tips and/or advice for deploying applications and keeping them secure during the lifecycle? (e.g. as a developer I may run applications in a secure environment, but then down the line someone runs my container with –privileged and exposes a security hole). The goal being our audience learns what to consider when choosing a platform (or platforms) to run applications from a security perspective.